Is voice to text GDPR compliant?

No voice to text tool is GDPR compliant in general. The GDPR regulates what an organization does with personal data, and a recording of your voice is personal data. So the answer depends on how a particular tool is set up and who uses it. The same app can be used in a compliant way by one business and in a non-compliant way by another. For the wider picture, see our overview of voice privacy and the guide to voice biometric data.

No certificate makes a voice to text tool compliant on its own

The GDPR has a certification scheme, but it is optional. Article 42 says: "The certification shall be voluntary and available via a process that is transparent. A certification pursuant to this Article does not reduce the responsibility of the controller or the processor for compliance with this Regulation" ¹.

So a vendor's statement that its product is "GDPR compliant" is a starting point, not an answer. The organization that uses the tool keeps its own duties. It must know why it processes the audio, what the vendor does with it, and how long it stays. A certificate does not change that.

Four things decide whether your use is compliant

A lawful basis must exist before audio is processed

Article 6 of the GDPR says: "Processing shall be lawful only if and to the extent that at least one of the following applies" ². Consent is one of the listed conditions, and so are others, such as a contract. The organization chooses its basis and has to be able to explain it. A vendor cannot pick the basis for a customer.

A cloud provider must work under a binding contract

When a cloud service transcribes audio for a business, the provider usually acts as a processor for that business. Article 28(1) requires that "Processing by a processor shall be governed by a contract or other legal act under Union or Member State law, that is binding on the processor with regard to the controller" ³. In practice this is the data processing agreement. Ask for it before any client, patient or employee audio is sent.

Consumer apps are a different case. If an app processes your audio for its own purposes, the app company is the controller of that data, and the rules you can rely on come from its privacy policy and the law, not from a contract with your employer.

Where the audio is processed and kept decides most of the risk

Microsoft, Google and Apple describe their speech services differently, and the details matter:

• Azure real-time speech to text. Microsoft says that "For real-time speech to text, audio input is processed only on the Azure's server memory, and no data is stored at rest" ⁴.
• Azure batch transcription. Here the customer chooses where the audio and transcripts are stored, and Microsoft says the customer controls their retention ⁵. The retention period is then the customer's responsibility, so set it on purpose.
• Google Cloud Speech-to-Text. Google says that "By default, Cloud Speech-to-Text does not log customer audio data or transcripts" ⁶. Logging is a setting you can turn on, so check it is off.
• Apple dictation on a Mac. Apple says that, on a Mac, voice inputs and transcripts for general text Dictation "are processed on your device and not sent to Siri servers" ⁷. Apple's help page describes the current macOS, and you can check the setting in Keyboard settings.

A tool that processes audio on the device sends less personal data to anyone. That is why on-device recognition is a useful test, explained in our glossary entry on on-device speech recognition. It does not settle every question, because the transcript is still stored wherever you save it.

Speaker identification raises the bar

Most dictation does not identify who is speaking. If a tool does, the stricter special category data rules apply. Article 9 lists biometric data used to identify a person among the special categories ⁸. Article 35(3)(b) of the GDPR says that a data protection impact assessment is required for "processing on a large scale of special categories of data referred to in Article 9 (1)" ⁹, so the assessment is for large-scale use, not for every identification. Our guide to voice biometric data covers the consent rules that go with it.

It depends on the use, so match the risk to the case

These readings are our own, based on the four points above. They are not legal advice, and a data protection officer or lawyer should decide the cases that matter to you.

The same questions apply to meeting transcription, where other people's voices are recorded. Our guide to human review of voice recordings explains who else may listen.

What to do before you dictate personal data

1. Test where recognition runs. Turn on airplane mode and try the tool. If it still transcribes, the recognition is on the device. Our guide to whether voice to text is safe walks through the test.
2. Ask for the processing agreement in writing. Ask the vendor for its data processing agreement and the retention period for audio and transcripts.
3. Turn off logging and training options when the service offers them, and confirm the setting in writing.
4. Complete an impact assessment before turning on voice ID. If a tool identifies speakers, treat it as high risk until a proper assessment says otherwise.
5. Check the answer for your own service. The rules above are the same for every vendor, so the answer comes from the setup, not the brand.

We make Yap, an on-device dictation app for Mac and Windows, so we have an interest here. Put the same five questions to it that you would put to any other vendor.

For the related questions, see whether a voice recording is personal data under GDPR, whether speech to text APIs store audio and whether voice data is sensitive under the CCPA.